WeGIA CVE-2025-67496

Exploitation requires: (1) the attacker must be able to get a malicious employee 'name' value persisted into the funcionario/pessoa database records that feed the dropdown - implying either a low-privileged authenticated account with employee-create/edit capability or another data-entry path; and (2) a victim, realistically a higher-privileged administrator, must subsequently load /WeGIA/html/geral/configurar_senhas.php so the unescaped name renders inside an HTML <option> element and the stored script executes (UI:R). Limiting factors: this is a stored/persistent XSS gated behind authentication (PR:L) and victim interaction (UI:R), so it is not exploitable against an unauthenticated attacker or without a human viewing the affected page; it affects WeGIA versions 3.5.4 and below only and is remediated in 3.5.5, so patched or newer installations are not vulnerable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, low-complexity stored XSS that nonetheless requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R) - someone must load the password-configuration page and view the poisoned employee dropdown for the payload to fire. The low EPSS score (0.25%, 15th percentile) indicates very low probability of broad opportunistic exploitation, which is consistent with a self-XSS-adjacent, auth-and-interaction-gated flaw in a niche product rather than an internet-facing RCE. It is NOT listed in CISA KEV, so there is no evidence of active exploitation. However, public exploit code DOES exist (the GitHub Security Advisory GHSA-9843-qm67-73h2 is tagged as an exploit reference), so the barrier to weaponization is low for anyone who already has an account. The signals are internally consistent: moderate CVSS, low EPSS, no KEV, POC available - pointing to a real-but-contained vulnerability best handled through normal patch cycles rather than emergency response, prioritized higher for internet-exposed WeGIA instances with multiple user accounts of differing privilege. Scope is marked Changed (S:C) because the injected script executes in the browser context of a potentially higher-privileged administrator viewing the dropdown, enabling privilege escalation via session/UI hijack.

An authenticated low-privilege WeGIA user (or an attacker who can influence an employee record) stores a malicious script inside an employee name field; the application later injects that name, unescaped, into an HTML <option> element on /WeGIA/html/geral/configurar_senhas.php. When an administrator opens the password-configuration page and the employee-selection dropdown renders, the script executes in the admin's session, enabling session/cookie theft or actions performed as the admin. Public exploit code exists via the GitHub Security Advisory, lowering the effort required to reproduce the attack.